MB-R098

AUTOMATED Unsafe XML parsing disabled

MB-C03 Secure Coding Practices High

No unsafe XML entity expansion patterns detected.

Why it Matters

Magento integrations often parse XML from feeds, ERPs, shipping providers, payment systems, or imports. Unsafe XML parser settings can allow XXE, SSRF, local file disclosure, or denial of service.

Disabling external entity expansion and unsafe parser features keeps untrusted XML from reaching local files or internal network resources.

Verification Steps

Code scan

grep -RIE "(simplexml_load|DOMDocument|loadXML|LIBXML_NOENT|LIBXML_DTDLOAD)" app/code 2>/dev/null

Parser review

Confirm external entities and DTD loading are disabled for untrusted XML

Remediation / Fix Guidance

Avoid parsing untrusted XML when JSON or provider SDKs are available.
Disable external entity loading, DTD loading, and entity substitution.
Reject XML with DOCTYPE when not required.
Set size and timeout limits for import feeds.
Add tests with XXE payloads for custom XML parsers.

Examples

Fail Example

$dom->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
# External entities may expand → FAIL

Pass Example

$dom->loadXML($xml, LIBXML_NONET);
# Network access blocked and no entity substitution → PASS